Abstract

Traditional methods of user authentication in distributed systems suffer from an important weakness which is due to the low degree of randomness in secrets that human beings can use for identification. Even though weak secrets (passwords and PINs) are typically not exposed in the clear over the communication lines, they can be discovered with off-line brute force attacks based on exhaustive trials. Since such secrets are chosen from a relatively small key space, a determined adversary can try all possible values until a match is found between the trial value and the message recorded from a genuine authentication session. Authentication devices like smartcards and token cards offer an attractive solution by providing a user with a cryptographically strong key for authentication. In contrast to passwords and PINs, the device's key can be chosen from a much larger key space thus making a brute force attack computationally infeasible or, at least, difficult. In this paper we present a nove...

Citations